v0.1.14 — two confirmation-gate false positives, two causes

Found by surveying 14 real agent frameworks and opening every finding in the source. Both confirmation-gate-fails-open false positives came from the same defect class as v0.1.13: a rule reading locally, with no requirement that the things it correlates belong together.

Cause 1 — cross-function correlation. The three patterns (x = inspect.signature(y), valid = x.parameters, a comprehension filtering on valid) were matched anywhere in the file. In microsoft/agent-framework a schema generator called inspect.signature(cls) and an unrelated comprehension filtered a set called valid_params. Fixed with a proximity requirement: _GATE_WINDOW = 1200 characters. The reference true positive spans ~110.

Cause 2 — a regex anchored on a string literal. _DICT_FILTER_USING_RE began \{[^{}]*?\bfor\b, which matched the { inside startswith("{") and spanned thirteen lines to an unrelated for field in common_fields: / if field in params: loop. A loop with a membership test is not a dict comprehension.

	before	after
microsoft/agent-framework	3	1
total, 14-framework survey	19	17
google/adk-python	3	3 (unchanged — the gate is still found)
tests	137	139

Two regression tests carry the real shapes.